[builtins] Fix crash on stack overflow in CheckSpreadAndPushToStack.

src/builtins/x87/builtins-x87.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X87
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 2786 matching lines @@
     __ Pop(edi);
     // Free up some registers.
     // Save edx/edi to stX0/stX1.
     __ push(edx);
     __ push(edi);
     __ fld_s(MemOperand(esp, 0));
     __ fld_s(MemOperand(esp, 4));
     __ lea(esp, Operand(esp, 2 * kFloatSize));
   }
 
-  Register return_address = edi;
   {
     // Calculate the new nargs including the result of the spread.
     __ mov(spread_len, FieldOperand(spread, FixedArray::kLengthOffset));
     __ SmiUntag(spread_len);
 
     __ bind(&push_args);
     // argc += spread_len - 1. Subtract 1 for the spread itself.
     __ lea(argc, Operand(argc, spread_len, times_1, -1));
-
-    // Pop the return address and spread argument.
-    __ PopReturnAddressTo(return_address);
-    __ Pop(scratch);
   }
 
   // Check for stack overflow.
   {
     // Check the stack for overflow. We are not trying to catch interruptions
     // (i.e. debug break and preemption) here, so check the "real stack limit".
     Label done;
     __ LoadRoot(scratch, Heap::kRealStackLimitRootIndex);
     // Make scratch the space we have left. The stack might already be
     // overflowed here which will cause scratch to become negative.
     __ neg(scratch);
     __ add(scratch, esp);
     __ sar(scratch, kPointerSizeLog2);
     // Check if the arguments will overflow the stack.
     __ cmp(scratch, spread_len);
     __ j(greater, &done, Label::kNear);  // Signed comparison.
     __ TailCallRuntime(Runtime::kThrowStackOverflow);
     __ bind(&done);
   }
 
   // Put the evaluated spread onto the stack as additional arguments.
   {
+    Register return_address = edi;
+    // Pop the return address and spread argument.
+    __ PopReturnAddressTo(return_address);
+    __ Pop(scratch);
+
     Register scratch2 = esi;
     // Save esi to stX0, edx/edi in stX1/stX2 now.
     __ push(esi);
     __ fld_s(MemOperand(esp, 0));
     __ lea(esp, Operand(esp, 1 * kFloatSize));
 
     __ mov(scratch, Immediate(0));
     Label done, loop;
     __ bind(&loop);
     __ cmp(scratch, spread_len);
@@ skipping 482 matching lines @@
 
 void Builtins::Generate_InterpreterOnStackReplacement(MacroAssembler* masm) {
   Generate_OnStackReplacementHelper(masm, true);
 }
 
 #undef __
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X87